/proc/mounts unreadable - bisected

/proc/mounts unreadable - bisected

[Marc Dionne]

With current git, /proc/mounts is unreadable on my system, with any attempts to 
read it returning EINVAL.  This breaks many init scripts, among other things.

I bisected it down to this commit:

commit 2069f457848f846cb31149c9aa29b330a6b66d1b
Author: Eric Paris <eparis@redhat.com>
Date:   Fri Jul 4 09:47:13 2008 +1000

     LSM/SELinux: show LSM mount options in /proc/mounts

     This patch causes SELinux mount options to show up in /proc/mounts.  As
     with other code in the area seq_put errors are ignored.  Other LSM's
     will not have their mount options displayed until they fill in their own
     security_sb_show_options() function.

In my case, selinux_get_mnt_opts() never gets very far because 
sbsec->initialized never becomes true, and the function systematically returns 
EINVAL which is then passed back up to the reader of /proc/mounts.

Changing show_sb_opts() to always return 0 (it was a void function before this 
commit) makes the system behave normally.

Now it's possible that my selinux config is hosed - I have it enabled in 
permissive mode but I don't pay much attention to it - but the failure mode in 
that case should probably be more graceful.  Seems like it would be better to 
print out the available mount info minus the LSM options than to bail out 
completely?

Thanks,
Marc

Re: /proc/mounts unreadable - bisected

[Eric Paris]

On Wed, 2008-07-16 at 20:53 -0400, Marc Dionne wrote:
> With current git, /proc/mounts is unreadable on my system, with any attempts to 
> read it returning EINVAL.  This breaks many init scripts, among other things.
> 
> I bisected it down to this commit:
> 
> commit 2069f457848f846cb31149c9aa29b330a6b66d1b
> Author: Eric Paris <eparis@redhat.com>
> Date:   Fri Jul 4 09:47:13 2008 +1000
> 
>      LSM/SELinux: show LSM mount options in /proc/mounts
> 
>      This patch causes SELinux mount options to show up in /proc/mounts.  As
>      with other code in the area seq_put errors are ignored.  Other LSM's
>      will not have their mount options displayed until they fill in their own
>      security_sb_show_options() function.
> 
> In my case, selinux_get_mnt_opts() never gets very far because 
> sbsec->initialized never becomes true, and the function systematically returns 
> EINVAL which is then passed back up to the reader of /proc/mounts.
> 
> Changing show_sb_opts() to always return 0 (it was a void function before this 
> commit) makes the system behave normally.
> 
> Now it's possible that my selinux config is hosed - I have it enabled in 
> permissive mode but I don't pay much attention to it - but the failure mode in 
> that case should probably be more graceful.  Seems like it would be better to 
> print out the available mount info minus the LSM options than to bail out 
> completely?

Yes, your SELinux config is hosed.  But I'll agree that we should just
pass over the LSM options in that case (since clearly there aren't any)
and not fail the read altogether.  Patch will be forthcoming.

-Eric